Security researchers at Jamf Threat Labs have uncovered a new strain of macOS malware they’re tracking as PamStealer — a sophisticated two-stage infostealer that validates stolen credentials through macOS’s built-in Pluggable Authentication Modules (PAM) interface before exfiltrating them.
PamStealer represents a notable evolution in macOS malware tradecraft. Distributed as a compiled AppleScript (.scpt) file inside a disk image that masquerades as the legitimate open-source clipboard manager Maccy, the malware uses an unusual combination of techniques designed to fly under the radar of traditional security tools.
Two-Stage Execution Chain
The first stage arrives as a disk image containing a file called Maccy.scpt. When double-clicked, macOS opens it in Script Editor, where the malicious functionality is buried deep beneath a block of empty lines. The script instructs users to press Command+R, which executes a self-contained JavaScript for Automation (JXA) downloader — notably using native Objective-C APIs rather than shell commands like curl or zsh.
This JXA dropper retrieves the second-stage payload: a Rust-based Mach-O binary compiled for Apple Silicon. Rust remains relatively uncommon in the macOS malware ecosystem, where Swift, Go, and Objective-C dominate. The choice of Rust makes the binary harder to analyze and contributes to the malware’s stealth.
Regional Targeting and Anti-Analysis
PamStealer includes environment-aware features that restrict its operation. It derives a decryption key from the host’s CPU architecture, locale, keyboard layout, and time zone — only unlocking its configuration on Apple Silicon Macs. Intel-based machines are completely skipped. The malware also checks for Russian, Belarusian, and other CIS region indicators, silently terminating if detected.
Additional anti-analysis measures include anti-debugging checks and System Integrity Protection (SIP) status verification, making it difficult to analyze in sandboxed environments.
PAM-Validated Password Capture
The malware’s namesake feature is its password capture workflow. PamStealer displays a native macOS dialog box reading: “Maccy wants to make changes. Enter your password to allow this.” When the victim enters their password, the malware validates it locally through the PAM API — not by calling dscl, security, or other shell utilities as most macOS stealers do.
If the password is incorrect, the dialog reappears until the correct one is provided. Once validated, the malware shows a decoy message claiming the file is damaged. The stolen credentials are then exfiltrated to the attacker’s command-and-control server over encrypted connections using ChaCha20-Poly1305.
Persistence and Data Theft
PamStealer establishes persistence by registering itself as a login item through both the modern ServiceManagement API and a legacy helper. It masquerades as system processes like Finder.app or Software Update.app and delays privilege escalation prompts by up to 40 minutes to decouple suspicious activity from launch time.
Beyond credentials, the malware targets browser databases, cryptocurrency wallets (including Ethereum accounts), and the system clipboard. Apple users should exercise caution when downloading clipboard managers or other utilities from unofficial sources.
